hxxps://recruitmenttable[.]com/lagos-state-government-recruitment-for-secondary-school-classroom-teachers/

Resubmissions

31/05/2024, 09:42

240531-lpdf2adg2x1

31/05/2024, 09:41

240531-lnrl9sed544

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
31/05/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://recruitmenttable.com/lagos-state-government-recruitment-for-secondary-school-classroom-teachers/
Sample240531-lpdf2adg2x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4832	msedge.exe
4832	msedge.exe
3012	identity_helper.exe
3012	identity_helper.exe
584	msedge.exe
584	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2924	4832	msedge.exe	78
PID 4832 wrote to memory of 2924	4832	msedge.exe	78
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 3952	4832	msedge.exe	79
PID 4832 wrote to memory of 4552	4832	msedge.exe	80
PID 4832 wrote to memory of 4552	4832	msedge.exe	80
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81
PID 4832 wrote to memory of 4232	4832	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://recruitmenttable.com/lagos-state-government-recruitment-for-secondary-school-classroom-teachers/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc2ff93cb8,0x7ffc2ff93cc8,0x7ffc2ff93cd8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18312455856040454293,243202541949941348,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 34afac298a256d796d20598df006222ed6900a0dafe0f8507ed3b29bfd2027d7
MD5 8e1dd984856ef51f4512d3bf2c7aef54
SHA1 81cb28f2153ec7ae0cbf79c04c1a445efedd125f
SHA512 d1f8dfc7fdc5d0f185de88a420f2e5b364e77904cab99d2ace154407c4936c510f3c49e27eed4e74dd2fbd850ad129eb585a64127105661d5f8066448e9f201d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7052a8294dd24294974bb11e6f53b7bf36feeb62ce8b5be0c93fbee6bc034afb
MD5 ffa07b9a59daf025c30d00d26391d66f
SHA1 382cb374cf0dda03fa67bd55288eeb588b9353da
SHA512 25a29d2a3ba4af0709455a9905a619c9d9375eb4042e959562af8faa087c91afafdb2476599280bbb70960af67d5bd477330f17f7345a7df729aaee997627b3a
MD5 SHA1 SHA512

Submit Download

8540345a-62e6-46b1-9b1f-5b125f1b51c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8540345a-62e6-46b1-9b1f-5b125f1b51c3.tmp
Size 5KB
SHA256 631f0d3ca7257191e12c97e59f1162e6456b3498d61a8c4d75dfb41a7d0cda09
MD5 f686672999eeae2d6091c8eafa86f33c
SHA1 2f98907718f93cb6d367992994137c2fe5036cd7
SHA512 37237fc8a2909ff243f226abe331fc2e22bdc11ebf28972121a0c8ff938a896068e43219b887b970cfcd8821487c9c0d977aef3064110ffbb5cab1edd5ed973a
SSDEEP 96:nr3k3V7dEkEqwSv0MoiVmdHIuJD0WQyV+VuziX3wI3:nr3k3tdEkEqv0MAIMDLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 b7dc5c8dcf1984c6707a02eab496f8354e3eca06493eb6e1a034e0d576d7fcd9
MD5 0a0c09e53c270e0e1a68867637556854
SHA1 ad994aa02aa681f2380fc26ac80733b97d39d805
SHA512 eb1b965cf30012d50079d1aa818a17a2cbc3231812250a70100cadb736e4699350f85361a60ed2e7e56d7de79cfd20a8e65037cb6217898d42a515ff6ab10b1e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1013B
SHA256 c8823b8acdbc19af9d254d740cc81d6ef77b3496f71344f2d07438b646c74f42
MD5 b3d2a1eb495a49dbbcf8738d79f50bf5
SHA1 2aa6c10bc8194913db9abaab64af0666689b0abb
SHA512 2b0d3d129512391fdec5607c6d491380387b8c3faa7126fd81463b6367c6396ca8621a1c1cc63e3ba88fd029f38529713d951967a17542c3f13ec31fcf5b9926
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 24bc298ab796820dfccb8b71a43fe6d47d017decb61617558bca43e0faff8ff2
MD5 691aa3bb70388d86a53059bca4f61e8f
SHA1 1b908565e1c6d163f94ae23b989655703efa3c8b
SHA512 4a74a592fe20980f1632e66ae695d82294b903a45c99dc2ec19ce7df2e3609d196a2fd6784640271c4e7fe8f496bb7d83322080dd23103302b1654f2ed6d7299
SSDEEP 96:nr3k3S7dEkEqwSv0MoiVmd4uR14IvMi2IFJD0WQyV+VpAiX3wI3:nr3k3idEkEqv0MHuRSli2I/DLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 699e72bcee1c17b3c617c56c6d16947b77b09ac56ac0d541d04e16f737ad6bf6
MD5 ee49b61e6952affccae70551b2706b86
SHA1 09f90f05c4e823ce5a6b34a031268a2329b0ae07
SHA512 289dbe5aa917441c242edad275d3ac2e2aa11236a9e96779acdef3104868e1fc891650cc866f19add923c843901e22f4929b2651c37425928104d13e78bfac74
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGUdde2RUl7RLfy97YvmljEW5e:M9iIxuERzA83h09RZxASGo5Qla97Yk9s
MD5 SHA1 SHA512 SSDEEP

Submit Download